XSS and Authentication bypass in NCT Jobs Portal Script

vendor:

NCT Jobs Portal Script

by:

Sid3^effects

7,5

CVSS

HIGH

XSS and Authentication bypass

CWE

Product Name: NCT Jobs Portal Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

XSS and Authentication bypass in NCT Jobs Portal Script

NCT Jobs Portal script is a web product for running powerful and customized job portals. Be it a fresh site that you want to launch or be it for integration into your already existing website, NCT Jobs Portal is everything you need when it comes to job portal or business networking solution. Jobs Portal comes with a front-end and a back-end (Admin Panel). Admin Panel has a wide range of functions along with a CMS (Content Management System) which will easily enpower you to customize and manage your very own Jobs Portal. The following script has authentication bypass in the admin login use ' or 1=1 or ''=' in both login and password. XSS is also found in the search field. Parameter Name: Keywords or Tags or Desired City Parameter Type: Querystring Attack Pattern: '"--><script>alert(0x000872)</script>

Mitigation:

Implement input validation and output encoding to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: XSS and Authentication bypass in NCT Jobs Portal Script
# Date: 24-apr-2010
# Author: Sid3^effects
# Software Link: N/a
# CVE : []
# Code : []      ______________________________________________________________________________
                    XSS and Authentication bypass in NCT Jobs Portal Script
                         Vendor:http://www.ncrypted.net/
     ___________________________Author:Sid3^effects_________________________________
  

Description :

NCT Jobs Portal script is a web product for running powerful and customized job portals. Be it a fresh site that you want to launch or be it for integration into your already existing website, NCT Jobs Portal is everything you need when it comes to job portal or business networking solution. Jobs Portal comes with a front-end and a back-end (Admin Panel). Admin Panel has a wide range of functions along with a CMS (Content Management System) which will easily enpower you to customize and manage your very own Jobs Portal.

script cost :$99 
---------------------------------------------------------------------------
	* Authentication bypass:

	The following script has authentication bypass in the admin login 

	use ' or 1=1 or ''=' in both login and password.

---------------------------------------------------------------------------
	* XSS (cross site scripting ) :
       
	XSS is also found in the search field. 

 Parameter Name: Keywords or Tags or Desired City
 Parameter Type: Querystring 
 Attack Pattern: '"--><script>alert(0x000872)</script>        
---------------------------------------------------------------------------

ShoutZ :
------- 
               ---Indian Cyber warriors--Andhra hackers-- 

Greetz :
--------
 ---*L0rd ÇrusAdêr*---d4rk-blu™® [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--